AI governance
Human approval for AI agents: a simple go / no-go policy for small teams
A one-page policy for when AI agents must ask a person first, who approves, what gets logged and how to keep shadow AI out. With a template you can copy.
Short answer
Let AI agents prepare work freely, but require a person to approve anything that sends, charges, signs, publishes or deletes. Give every agent a named human lead, limit its access to what its role needs, log every action in plain words, and allow only approved AI tools. That covers most of the risk for a small team in one page.
Key takeaways
- Draw the line at actions that leave your organization or can't be undone.
- In IBM's 2025 breach research, 63% of breached organizations had no AI governance policy or were still writing one.
- Shadow AI, meaning AI tools used without approval, added $670,000 to average breach costs where it was common.
- A short policy that people follow beats a long one nobody reads.
Contents
Why small teams need an approval rule now
AI agents are useful because they act, not just answer. That is also the risk. A draft that sits in a queue harms no one. An email sent to 2,000 members, a charge on the wrong card, or a deleted record can do real damage.
The research says most organizations are not ready. In IBM's Cost of a Data Breach Report 2025, 63% of breached organizations had no AI governance policy or were still developing one. One in five reported a breach involving shadow AI, and organizations with high levels of shadow AI saw breach costs $670,000 higher on average than those with little or none.
The five actions that need a go
A simple, memorable line: agents may prepare anything, but a person gives the go before an agent does any of these five things.
| Action | Examples | Why it needs a person |
|---|---|---|
| Sends | Emails, texts, messages to customers or members | It reaches people outside your team |
| Charges | Invoices, refunds, payments, subscription changes | It moves money |
| Signs | Contracts, agreements, forms on your behalf | It commits your organization |
| Publishes | Web pages, posts, public listings | It speaks for you in public |
| Deletes | Records, files, accounts | It can't easily be undone |
A one-page policy you can copy
- Scope. This policy covers every AI tool and agent used for our work, on any device.
- Approved tools only. We keep a list of approved AI tools. Anything else needs approval from the policy owner before use.
- Go / No-go. Agents may prepare work, but a person approves before any agent sends, charges, signs, publishes or deletes.
- One human lead per agent. The lead sets its instructions, reviews its work and can pause it at any time.
- Least access. Each agent gets only the tools and data its role needs.
- Log everything. Every agent action is recorded with who or what did it, when and on which record.
- Sensitive data. Customer, member, financial and personal data stays in approved tools.
- Review. The policy owner checks the tool list, access and log every quarter.
How to roll it out in a week
- Day 1: List the AI tools people already use. Ask; don't assume.
- Day 2: Approve the ones you will keep and set up accounts the organization controls.
- Day 3: Name a human lead for each agent and set role-based access.
- Day 4: Turn on the approval queue for the five actions, and check the log works.
- Day 5: Share the one-page policy, walk through one real approval together, and set the quarterly review date.
How Mission Control handles it
In Mission Control, every agent on the crew has a human lead and role-based access. Anything that sends, charges, signs, publishes or deletes waits in Go / No-go until a person approves it, and every action lands in the Mission Log in plain words. The built-in Steward tool keeps your approved AI tools on the record. You can try the approval queue in the product tour.
Questions
- Do AI agents need human approval?
- For actions that leave your organization or can't be undone, yes. A common rule is that agents can prepare anything, but a person approves before an agent sends, charges, signs, publishes or deletes.
- What is shadow AI?
- Shadow AI is AI tools used for work without the organization's knowledge or approval. IBM's 2025 research found it added $670,000 to average breach costs where it was common.
- What should an AI policy for a small business include?
- An approved tool list, a human approval rule for high-impact actions, a named lead for each agent, role-based access, an action log, rules for sensitive data and a quarterly review.
- What is human in the loop?
- Human in the loop means a person reviews or approves an AI system's output before it takes effect, especially for actions with real consequences.
Sources
We check every figure against its original source. Spot something out of date? Reply to any of our emails and we'll fix it.